ID. Date of interview 
date 42/92/20 


ID. Time interview started 
start 14:59:56 


ID.end Completion date of interview 
Date 42/02/20 


ID.end Time interview ended 
15:30:37 


ID. Duration of interview 
time 30.68 
new CaSe 


ICO consultation on the draft right of access 
guidance 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 


Does the draft guidance contain the right level of detail? 


© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Q3 


Does the draft guidance contain enough examples? 
© Yes 
—) No 

©) Unsure / don't know 

If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


Q4 


We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 

unfounded or excessive’ subject access requests. We would like to include a wide 

range of examples 

from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 

requests below (if applicable). 


Q5 


Q6 


Q7 


On a scale of 1-5 how useful is the draft guidance? 


3 ee: 
1-Notatall 2-Slightly Moderately 
useful useful useful 
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Why have you given this score? 
Clear language and the examples provided are very helpful 


4 — Very 
useful 


© 


5 — Extremely 
useful 
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To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree 
disagree Disagree nor disagree 
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Agree 
( 


j] 


Strongly 
agree 


© 


Q8 


Q9 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


We are concerned about the passage in the draft guidance at page 23, which states 
that clarifying a request no longer affects the timescale for responding for the 
following: e Proportionality — if controllers are not able to make reasonable 
enquiries of the requester and await their response, in order to attempt to narrow 
the scope, this limits their ability to respond in a way which is proportionate (and 
allocates a proportionate amount of their resources), to the nature and scope of the 
request; e Encourages data controllers not to request clarification — if a data 
controller still has to comply with the original timescale if they request clarification, 
they may decide not to waste time waiting for clarification. This may result in data 
subjects receiving lots of unnecessary data which was not what they actually wanted 
and would be contrary to the principles of access to personal data; e Errors due to 
reduced timeframe - if a data controller does request clarification, and the data 
subject does not respond immediately, the data controller may find themselves with 
a very limited timeframe to respond to the request after clarification is given. This is 
likely to result in an increase in mistakes being made due to increased time 
pressures, which could either be failing to redact third party personal data, or not 
providing the data subject with all the data they have requested, and so leading to 
complaints from data subjects and elongation of the SAR process; and e 
Vexatious/litigious motives — this may motivate requesters with vexatious/litigious 
motives to make broad and sweeping requests for all of their personal data, even if 
they only want one or two specific documents, for tactical reasons (and to create an 
expensive and difficult task for the data controller). The data subject's motive for 
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Are you answering as: 

C) An individual acting in a private capacity (eg someone providing their views as a member of the public) 
(`) An individual acting in a professional capacity 

© On behalf of an organisation 

€ ) Other 

Please specify the name of your organisation: 

Trowers & Hamlins LLP 


What sector are you from: 
Legal services 


Q10 How did you find out about this survey? 
©) ICO Twitter account 
(C) ICO Facebook account 
©) ICO LinkedIn account 
C) ICO website 
\_) ICO newsletter 
(_) ICO staff member 
©) Colleague 
(`) Personal/work Twitter account 
( _) Personal/work Facebook account 
() Personal/work LinkedIn account 
“` Other 
If other please specify: 


